A small set of conventions and services that sit beside AI development work and constrain it mechanically

The system never stores untimed mutable state about anything it governs. Every governed statement is an immutable instance, identified by ID, version, and instantiation timestamp. Changing anything produces a new instance; the prior instance remains addressable forever as the authentic record of what was asserted, when, by whom.

Four things are kept separately queryable and never conflated: the record (immutable), the resolved current state (a query), the evidenced claim (a record with current passing evidence), and truth (which evidence tracks but never owns).

Three consequences are enforced rather than encouraged:

• References identify, never locate. A reference is an ID. References by file path or line number are fragile couplings, prohibited in governed content.
• Two independent authoring sources for one fact are a source of falsehood. Every fact has exactly one authoring chain; every other appearance is a resolved reference or a generated rendering.
• Documents are assemblies. A document, as read, is an assembly of resolved atoms at a given time — so retrieval assembles the latest valid instances by construction, or a faithful historical assembly when pinned.

Documents are serialization containers; governance attaches to atom IDs, never to filenames. The central construction is the binding triple: a rule is the composition of exactly one claim, one control, and one enforcement. An unbound claim is a proposal; a claim becomes enforceable the moment an active rule binds it — which makes enforceability a computable property of the corpus.

Several refusals are encoded at schema level, where they cannot be overridden per instance. Restrictions carry injection: never and are checked in gates before and after execution. The enforcement ladder contains no kill value — the strongest consequence is suspend-and-escalate to the human veto gate. Mandates reference models by band label; a model literal fails validation. And a story with an empty acceptance list is schema-invalid and therefore unschedulable: an untestable story is unrepresentable, not merely discouraged.

The answer is not immutable memory — memory must evolve; grooming, consolidation, and decay are features. It is the separation of two malleabilities: the memory population changes freely, while every claim it contains is pinned, timestamped, and superseded in the open. Memory stays soft; truth does not.

Retrieval weight is a measurement stream, never a stored field. Each retrieval writes an append-only row, and weight is a standing query over that stream. Ranking is thereby auditable and structurally resistant to self-preference entrenchment — the measured tendency of model evaluators to favor their own outputs never accumulates into the stored record.

And resolution wins: when an agent’s in-context recollection conflicts with the resolved current instance, the resolved instance is ground truth. A memory contradicting its own resolved sources is defective by definition.

There is exactly one entity type. A human’s core identity, a human persona, a browser session, a service certificate, and a spawned sub-agent are all instances of the identity-bearing actor at different positions in a signing chain rooted at a cold root keypair. No component may define a second entity type or branch on human-versus-agent beyond a descriptive property.

The attenuation law governs the chain: a child credential can never carry a capability absent from its parent’s grant. Verification is a chain walk to root, and a credential that fails the walk is rejected at the surface it presents to. Authority is granted, never inferred from behavior, history, or kind.

Rules may have governed exceptions; credentials may only have limiters. An exception may suspend or select among pre-ratified consequences — it may never grant, widen, or mint authority. A waiver is a governed exception with a required expiry — an indefinite waiver is schema-invalid — scoped narrower than the rule it suspends, and self-rearming on expiry.

Enforcement sits at chokepoints that already hold authority over the governed transition: the forge over merges, the harness over spawns, the bus over messages. Embedded gates can drift too — they are versioned and digest-pinned for that reason — but a merge gate that will not pass an invalid atom is a property of the forge, with no separate service to fail open.

The atom store is git; ratification is physically the signed merge that lands a decision atom, so the adopting act and its cryptographic record are the same event. The index is generated, never authored — index loss is an inconvenience, never a truth loss.

Evidence emission is structural: every control invocation writes an evidence record, so no check can execute without leaving a mark. But evidence completeness is structural while evidence validity is graded — a control can run perfectly while measuring the wrong property, which is why control definitions and test oracles are themselves versioned, governed atoms, open to the same attack as everything else.

Throughout, similarity proposes and gates dispose: semantic machinery surfaces candidates; it never directly triggers enforcement.

Every element is a reference except the directive itself, which is anchored verbatim, and the chain must be walkable from any element to all others.

Supply-chain attestation frameworks record how an artifact was built — steps, builders, signatures. This chain joins the why to the how: the decision and the authority behind the work, bound to the identity that executed it and the evidence that graded it.

Combined with structural evidence emission and signed-merge ratification, it answers the question governance of AI-built software turns on — who decided this, under what authority, executed by what, verified how — by query, for every artifact the plane produces, with completeness itself a standing query rather than an assumption.